*** EX RELS 03338 Release *** Total number of signatures: 6020 Description ================================================================== In this signature, we addressed the exploits/vulnerabilities and applications as below: Added 17 rule(s): --------------- 1133858 SIP Digium Asterisk SIP CSeq Heap Buffer Overflow 1133860 SCADA Netikus EventSentry XSS via SNMP 1133861 WEB Apache Struts 2 OGNL Script Injection -7 1133862 SIP Digium Asterisk chan_skinny SCCP packet Denial of Service -1 1133863 SIP Digium Asterisk chan_skinny SCCP packet Denial of Service -2 1133864 WEB Cisco Prime Infrastructure and EPNM SystemPreferences_Configurable Cross Site Scripting -1.1 (CVE-2017-6699) 1133865 WEB Cisco Prime Infrastructure and EPNM SystemPreferences_Configurable Cross Site Scripting -1.2 (CVE-2017-6699) 1133866 WEB Cisco Prime Infrastructure and EPNM ImportJobResults.jsp Cross Site Scripting -1.1 (CVE-2017-6699) 1133867 WEB Cisco Prime Infrastructure and EPNM ImportJobResults.jsp Cross Site Scripting -1.2 (CVE-2017-6699) 1133869 SIP Digium Asterisk pjsip_multipart_parse Denial of Service -1.1 1133870 WEB Cisco Prime Collaboration Provisioning logconfigtracer.jsp Directory Traversal -1 (CVE-2017-6621) 1133871 SIP Digium Asterisk pjsip_multipart_parse Denial of Service -1.2 1133872 SMB SMBLoris Denial of Service Vulnerability 1133873 WEB Cisco Prime Collaboration Provisioning ScriptMgr Authentication Bypass -1 (CVE-2017-6622) 1160563 MEDIA PornHub.com access via SSL -1 1160564 MEDIA PornHub.com access via SSL -2 1160577 SOCIAL Twitter transfer via SSL -1 Modified 59 rule(s): --------------- 1050015 WEB Cross-site Scripting -34 1051783 P2P Gnutella access via TCP -1 1052108 TERMINAL PcAnywhere Access Port-5631 access via TCP -1 1052586 TUNNEL SoftEther/PacketiX access via SSL -1 1052604 TUNNEL HTTP-Tunnel access via TCP -1 1052638 P2P Gnutella-iMesh/Lphant access via TCP -3 1052668 TUNNEL Ping Tunnel access via ICMP -1 1053048 NETWORK SSL/TLS Handshake access via SSL -1 1053409 TERMINAL PCAnywhere access via TCP -1 1053873 P2P Gnutella-Cabos access via UDP -1 1054074 TUNNEL SoftEther/PacketiX access via SSL -2 1060166 TUNNEL GPass access via TCP -1 1060177 TUNNEL Glype access via TCP -1 1060235 P2P Pando access via TCP -1 1060644 P2P Thunder access via TCP -6 1060981 P2P Deepnet Explorer access via TCP -1 1061032 TUNNEL CgiProxy access via TCP -2 1063404 MAIL IMAP4 access via TCP -1 1063405 MAIL NNTP access via TCP -1 1063467 DB_ERP PostgreSQL access via TCP -2 1063480 TUNNEL Glype access via TCP -2 1063660 NETWORK SSL/TLS Handshake access via SSL -2 1063661 NETWORK SSL/TLS Handshake access via SSL -3 1063662 NETWORK SSL/TLS Handshake access via SSL -4 1063663 NETWORK SSL/TLS Handshake access via SSL -5 1063939 NETWORK SSL/TLS Handshake access via SSL -6 1064038 GAME Diablo3 access via TCP -3 1064113 IM Apple iMessage access via SSL -1 1064148 MEDIA VLC access via TCP -2 1064491 TUNNEL GPass access via TCP -2 1064757 DB_ERP SAP access via TCP -1 1065537 P2P Kazaa Lite Tools K++ access via UDP -1 1065950 MAIL NNTP access via TCP -2 1067737 TERMINAL pcAnywhere access via TCP -2 1067963 TUNNEL Hamachi access via TCP -1 1067966 TUNNEL SoftEther/PacketiX access via SSL -3 1068061 TUNNEL Glype access via TCP -3 1068074 TERMINAL ShowMyPC access via TCP -2 1068106 TUNNEL CgiProxy access via TCP -1 1068139 TUNNEL Frozenway access via TCP -1 1068555 TUNNEL SoftEther/PacketiX access via TCP -1 1068827 IM IPMSG access via UDP -1 1068828 IM IPMSG access via UDP -2 1068845 GAME Lineage access via TCP -4 1069019 MEDIA Cradio access via TCP -3 1069020 MEDIA Cradio access via TCP -4 1069246 TUNNEL HotspotShield access via SSL -2 1069534 IM IPMSG access via TCP -1 1069623 UPDATE SONY PC/Xperia Companion access via SSL -1 1133735 SMB Samba Writeable Share Insecure Library Loading -1 (CVE-2017-7494) 1133850 SMB Samba Symlink Directory Traversal 1133852 SMB Samba Writeable Share Insecure Library Loading -2.1 (CVE-2017-7494) 1133854 SMB Samba Writeable Share Insecure Library Loading -3 (CVE-2017-7494) 1133855 WEB GoAhead IPCam Remote Code Execution -2 1133856 SMB Samba Writeable Share Insecure Library Loading -2.2 (CVE-2017-7494) 1160046 TUNNEL HotspotShield access via SSL -4 1160052 WEB Akamai.net access via SSL -2 1160062 TUNNEL HotspotShield access via SSL -5 1160127 TUNNEL HotspotShield access via SSL -6 Deleted 30 rule(s): --------------- 1051213 P2P DirectConnect transfer via TCP -1 (old rule) 1051900 P2P DirectConnect $Supports access via TCP -1 (old rule) 1051901 P2P DirectConnect access via TCP -1 (old rule) 1053091 P2P Soulseek connect via TCP -1 (old rule) 1053098 P2P KCeasy connect via TCP -1 (old rule) 1053197 IM Lava-Lava login via TCP -1 (old rule) 1053199 IM Paltalk login via TCP -1 (old rule) 1053203 IM Kubao login via TCP -1 (old rule) 1053316 IM Kubao login via TCP -2 (old rule) 1060107 TUNNEL Vtunnel connect via TCP -1 (old rule) 1060161 TUNNEL Megaproxy connect via SSL -1 (old rule) 1060228 FILE Diino login via SSL -1 (old rule) 1060252 TUNNEL BypassThat connect via TCP -1 (old rule) 1061383 P2P GNUnet connect via TCP -1 (old rule) 1061563 MEDIA CNTV access via TCP -1 (old rule) 1063222 P2P Soulseek transfer-download via TCP -1 (old rule) 1063639 FILE Rapidshare access via SSL -1 (old rule) 1063910 FILE Diino access via TCP -1 (old rule) 1064172 TUNNEL Megaproxy access via TCP -1 (old rule) 1064406 IM Paltalk login via TCP -2 (old rule) 1065358 MEDIA CNTV media via TCP -1 (old rule) 1065359 MEDIA CNTV media via TCP -2 (old rule) 1065827 TUNNEL Surrogafier connect via TCP -1 (old rule) 1066156 MEDIA CNTV login via TCP -1 (old rule) 1066673 MEDIA CNTV login via TCP -2 (old rule) 1066674 MEDIA CNTV media via UDP -1 (old rule) 1066773 MEDIA CNTV login via TCP -3 (old rule) 1066880 FILE Sendspace access via TCP -1 (old rule) 1067437 TUNNEL Vtunnel access via SSL -1 (old rule) 1068556 FILE Sendspace access via SSL -1 (old rule)